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Random numbers represent an indispensable resource for many applications. A recent remarkable 
result is the realization that non-locality in quantum mechanics can be used to certify genuine 
randomness through Bell's theorem, producing reliable random numbers in a device independent 
way. Here, we explore the contextuality aspect of quantum mechanics and show that true random 
numbers can be generated using only single qutrit (three-state systems) without entanglement and 
non-locality. In particular, we show that any observed violation of the Klyachko-Can-Binicioglu- 
Shumovsky (KCBS) inequality [Phys. Rev. Lett. 101, 20403 (2008)] provides a positive lower 
bound on genuine randomness. As a proof-of-concept experiment, we demonstrate with photonic 
qutrits that at least 5246 net true random numbers are generated with a confidence level of 99.9%. 
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Random numbers are widely used in algorithms and 
technology [1, 2]. However, generation of genuine ran- 
domness is a challenging task [3]. Mathematically, ran- 
domness means unpredictability [4, 5]. Thus, in principle, 
random numbers can never be generated by a classical 
device since any classical system bears a deterministic 
description. Consequently, random numbers generated 
by a classical device can always be attributed to a lack 
of knowledge about the device. If we know all the in- 
formation of the device, in principle we can predict all 
the results of any operation on this device. Unlike clas- 
sic systems, quantum theory is intrinsically random. It 
is natural to think about generating random numbers 
via a quantum device. In fact, various quantum random 
number generators (QRNGs) have already been reported. 
Significant examples include those based on the decay of 
radioactive nucleus [6], beam splitters [7-9], entangled 
photon pairs [10] and amplified quantum vacuum [11]. 
However, in real experiment the intrinsic randomness of 
these QRNGs is inevitably mixed-up with an apparent 
randomness due to noise or lack of control of the experi- 
ment. In other words, the randomness generated by these 
QRNGs cannot be unequivocally certified or quantified. 
This will jeopardize some applications of randomness, 
especially cryptographic applications. A breakthrough 
was made by Colbeck [12] and subsequently developed 
by Pironio et al [3, 13]. The basic idea is to use the non- 
local correlation of quantum states to generate certified 
private randomness. More specifically, Bell's theorem can 
be used to certify genuine randomness. In Ref. [3], taking 
the Clauser-Horn-Shimony-Holt (CHSH) inequality [14] 
as an example, Pironio et al demonstrated for the first 
time this important idea with a proof-of-concept experi- 
ment using entangled trapped ions. A more recent work 
in this direction is Ref. [15]. 

Here, we introduce a new method to generate true 
random numbers in single-qutrit systems through ex- 
ploration of the Kochen-Specker (KS) theorem. Gener- 
ation of randomness by this method does not rely on 



the costly quantum resource of entanglement, which sig- 
nificantly simplifies its experimental realization. The 
Kochen-Specker theorem [16-18] states that no non- 
contextual hidden variable model (NCHVM) can repro- 
duce the prediction of quantum mechanics, or simply put, 
quantum mechanics is contextual. In recent years, ex- 
tensive works on quantum contextuality have been done, 
including both theoretical analyses [19-23] and experi- 
ment demonstrations [24-30]. All the experimental re- 
sults favor quantum mechanics and hence rule out the 
NCHVM. Here, we exploit this theorem from a new an- 
gle and show that it can be used to generate genuine 
randomness. To this end, we explore a KS inequality 
introduced recently by Klyachko, Can, Binicioglu and 
Shumovsky (KCBS) [19], and show that any observed vi- 
olation of the KCBS inequality leads to a positive lower 
bound on the randomness produced by the quantum de- 
vice. Furthermore, as a proof-of-concept experiment, we 
demonstrate this new method with photonic qutrits by 
showing that at least 5246 net true random numbers are 
generated with a confidence level of 99.9%. 

To be specific, we consider a single qutrit system and 
five two-outcome measurements Ai (i = 1, 2, 3, 4, 5). De- 
noting the outcome of the the corresponding measure- 
ment Ai as etj (a,; = 0,1), the KCBS inequality can be 
rewritten as [19, 29]: 

L = i p ( a i ^ a i\ A i A j) ~ p i a i = Oil^Mi)] < 3 > 

(1) 

where S = {(1, 2), (2, 3), (3, 4), (4, 5), (5, 1)} represents 
the set of pairs of compatible (commutable) measure- 
ments, and P(di 7^ a^AiAj) (P(ai — dj\AiAj)) is 
respectively the probability that ai a,j (ai = aj) 
when the measurement setting (Ai,Aj) is chosen. The 
inequality (7) is satisfied by any NCHVM. In quan- 
tum mechanics, however, this inequality can be violated 
for certain measurements performed on a specific state 
and the maximal violation is 4-\/5 — 5 « 3.944 [19]. 
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FIG. 1: The min-entropy bound f(L) versus different levels 
L of the KCBS violation. The black-square line is obtained 
through optimization based on the semi-definite programming 
(SDP) assuming validity of quantum mechanics. We can relax 
this assumption and do not assume the formalism of quantum 
mechanics, but only require that for two compatible (corn- 
mutable) observables, a measurement on one observable does 
not change the marginal probability distribution of measure- 
ment outcomes of the other observable. This corresponds to 
the no signaling (NS) condition for bi-partite system and we 
still call it the NS condition. The red-dotted line corresponds 
to an analytical lower-bound f(L) = — log 2 (1.75 — L/4) ob- 
tained under the NS condition only (see the supporting infor- 
mation for a detailed derivation). 

An experimental violation has been reported recently 
in Ref. [29]. For our purpose to relate the KCBS vi- 
olation to the generation of randomness, we run the 
experiment k times in succession. The measurement 
choice (Ai,Aj) for each trial is generated by a computer 
through an identical and independent probability distri- 
bution P(AiAj) G S). Denoting the input string as 
X = (j4jj , Aj 1 ; • • • ; Ai k , Aj k ) and the corresponding out- 
put string as O = (a il , aj 1 ; • • • ; a^, a,j k ), the estimated 
KCBS violation can be obtained from the observed data 
as 

L = l [N(a i ^a j \A i A j )-N(a i = a j \A i A j )}/P(A i A j 

(2) 

where N(di ^ a,j\AiAj) (N(a,i = a,j\AiAj)) denotes 
respectively the number of trials with unequal (equal) 
measurement outcomes under the measurement setting 
(Ai ,Aj). 

Let {£ m : < m < m max } be a series of KCBS vi- 
olation thresholds with Cq = 3 and C nimax = 4y5 — 5 
corresponding respectively to the classical and quantum 
bound, and denote V(m) the probability that the ob- 
served KCBS violation L lies in the interval [C m , C m +i), 
then we can use the min-entropy to quantify randomness 



FIG. 2: The min-entropy bound kf(jC m — e) — log 2 4 versus the 
number of trials k assuming that the observed KCBS violation 
lies within the interval 3.9 = C m < L < Cm+i = 4\/5 — 5 ~ 
3.944 with non-negligible probability 8. Here the parameters 
are chosen as S = 0.001 and e' = 0.01. We take two different 
distributions for the input pairs (Ai,Aj): a uniform distribu- 
tion with P(AiAj) = 1/5 G S, and a biased distribu- 
tion with P(AiA 2 ) = 1 - 4afc- 1/2 , P{A 2 A 3 ) = P{A 3 A 4 ) = 
P(A 4 A 5 ) = P(AiA 5 ) = ak~ 1/2 , and a = 6. According to Ta- 
ble I, the KCBS violations for the uniform and biased cases 
are L uni = 3.924 and L Ma = 3.905, respectively. Thus, both 
L uni and L hla lie within the interval [3.9, 3.944). We plot both 
min-entropy bounds kf(C m — e) — log 2 4 based respectively 
on the SDP optimization and the NS condition (see caption 
of Fig. 1). The stars represent the experimental data where 
approximately 10 5 measurement outcomes are recorded from 
the detectors (k « 10 5 ). The inset shows the lower bounds of 
the net entropy (the output entropy minus the input entropy 
for distribution P(AiAj)) for the biased cases. We get about 
5246 net random numbers from the experimental data for the 
biased SDP case. 

of the output string O [3, 31, 32]: 

E x (0\l,8,m) v = -log 2 ^2v(l,S\m)[maxV(0\l,£,m)], 

x,e 

(3) 

where £ represents the knowledge that a possible adver- 
, sary has on the state of the device and the maximum 
is taken over all possible values of the output string 0; 
the probability distribution T)(0,I,£) is defined in the 
supplementary information. In order to build a link be- 
tween the KCBS violation and randomness, we assume: 
(i) the system can be described by quantum theory; (ii) 
the input (A^ , Aj l ) is chosen at step I from an indepen- 
dent random distribution uncorrelated with the system; 
(iii) the pair of measurements at step I are compatible 
(one measurement does not influence the marginal distri- 
bution of the outcomes of the other measurement) ; (iv) 
the adversary's side-information is classical. Based on 
these assumptions, we can show that if D(m) > <5, the 
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FIG. 3: Schematic experimental setup of a ture quantum random number generator, (a) State preparation of a single photonic 
qutrit. Ultrafast laser pulses (with a repetition rate of 76 MHz) at the wavelength of 400 nm from a frequency doubled 
Ti:sapphire laser pump two joint beta-barium-borate (BBO) crystals and generate correlated photon pairs at the wavelength of 
800 nm. A photon-count at the detector DO heralds a single photon at the other output port, which is split by two polarizing 
beam splitters (PBS) into three spatial models, representing a single photonic qutrit. By adjusting the orientations of the 
half wave plates (HWP1 and HWP2), we can prepare any qutrit state. The setup in box (b) implements the measurements. 
By tuning the wave plates (HWP5, HWP6, and HWP8), we measure the probability P(a,ia,j\AiAj) for a pair of compatible 
observables (Ai,Aj) £ S. The input pairs (Ai,Aj) are chosen according to the distribution P(A%Aj). To get the desired 

(Ai,Aj), the orientations of HWPs are listed in the Supporting information. The wave plates HWP3, HWP4, and HWP7 can 
be tilted to balance the Mach-Zender interferometers and their angle are set to zero. The photons are recorded by single photon 
detectors D0-D3 after spectra-filters of 3 nm bandwidth for coincidence measurements. 



min-entropy of the output string conditioned on the in- 
put string and the adversary's information has a lower 
bound (see derivation in Sec. II of the supplementary 
information) : 

E 00 (0\l,£,m) v >kf{C m -e)-\og 2 - x , (4) 

o 

where the parameter e = {— 2[1 + (4v5 — 
5)r] 2 (lne')/(A:r 2 )}3 with r = minP^A,), the 
smallest probability of the input pairs; d is another 
given parameter denoting the closeness between the 
resulting distribution that characterize k successive 
use of the device and another extended distribution 
that is well defined mathematically. The function /(£*) 
is obtained by semi-definite programming (SDP) [33] 
and is shown in Fig. 1; and the min-entropy bound 
kf(C m — e) — log 2 j for different numbers of trials k 
is plotted in Fig. 2. It is remarkable that other than 
the above four basic assumptions, there is no further 
constraint on the states, measurements, or the Hilbert 
space. It also requires no assumption that the system 
behaves identically and independently for each trial. In 



particular, the system may have an internal memory 
(classical or quantum) so that the results of the Zth 
trial depend on the previous I — 1 trials. Any observed 
violation of the KCBS inequality with L > 3 leads 
to a positive lower bound on the min-entropy, and 
thus guarantees genuine randomness generated by the 
quantum device. 

In order to experimentally implement our scheme, we 
use photonic qutrits where the states are represented by 
three different paths of a single photon. For each pho- 
tonic qutrit, we randomly choose the compatible mea- 
surement configurations (AiAj) from the set S according 
to a certain probability distribution P(AiAj) (uniform 
or biased, with its form given in caption of Fig. 2) and 
record the measurement outcomes (a* , dj ) , which gives 
our output random bits. To generate random numbers, 
we need to observe violation of the KCBS inequality and 
the level of violation gives bound on genuine random- 
ness according to Eq. (4). Different from the experi- 
ment in Ref. [29] on test of quantum contextuality with 
the KCBS inequality, to generate randomness, the in- 
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0.0927 
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0.4611 
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0.4477 
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(A 4 ,A 5 ) 


0.4935 
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0.4846 


0.4235 


0.0918 


(A,,A 5 ) 


0.4159 


0.4629 


0.1212 


0.4414 


0.4355 


0.1230 


Observed 
violations 


Z = 3.924±0.010 


£ = 3.905 + 0.025 



FIG. 4: Table I: Experimentally observed probabilities and the corresponding KCBS violation under uniform or biased distribu- 
tion P(AiAj) (see caption of Fig. 2 for specification). The probability P(ll\AiAj) is negligible as the three-photon coincidence 
rate is typically smaller than the two-photon coincidence rate between DO and Di by more than four orders of magnitude and 
thus much less than the error bar. For both cases, the KCBS inequality is significantly violated, guaranteeing the generation 
of genuine randomness. 



put pairs (Ai , Aj ) need to be chosen randomly according 
to a probability distribution P(AiAj) (instead of fixed 
before the experiment), and we need to record the whole 
measurement output sequence O = (a^ , ; • • • ; di k , aj k ) 
instead of simply the total number of events N(a t ^ 
aj\AiAj) and N(a,i = a,j\AiAj)). 

The experimental setup is depicted in Fig. 3. The 
spontaneous parametric down conversion (SPDC) pro- 
cess generates entangled photon pairs. Through detec- 
tion of one of the photons by a detector DO, we get a 
heralded single-photon source on the other output mode. 
Two polarization beam splitters (PBS) split this heralded 
photon into three spatial models, representing a single 
photonic qutrit. Any state of this photonic qutrit can be 
prepared by adjusting the orientations of the wave plates 
before the PBS. The measurements are implemented by 
three half wave plates and three single-photon detectors 
D1-D3. The angles of these wave plates corresponding to 
different pairs of compatible observables are listed in the 
supporting information (Table 1 of Sec. IV). We assign 
value 1 (0) to the observable Ai under a click (non-click) 
of the corresponding detector. Due to the inevitable pho- 
ton loss, there could be no click on the detectors D1-D3 
even when the detector DO records an event. We dis- 
card all the events in which only the trigger detector 
DO and none of the measurement detectors D1-D3 fires. 
This is the post-selection technique commonly used in 
the photon experiments [29], which opens up the detec- 
tion efficiency loophole. We thus need the fair-sampling 
assumption that the photons selected out by the coinci- 
dence measurement represent a fair sampling of all the 
events. The detection efficiency loophole can be closed 
by using single-ion qutrits, where one can follow the same 
experimental procedure here and generate true random 
numbers using only high-speed single-bit rotations. 

The experimental results are summarized in Table I. 
For both the uniform and biased input cases, we record 



about k ss 10 5 events. The observed KCBS violation in- 
dicates that E™\0\T, E, m) > 6.3xl0 4 and E^{0\2) > 
1.6 x 10 4 with a 99.9% confidence level, so tens of thou- 
sands of genuine random numbers have been generated 
in both cases. Similar to Ref. [3], the scheme described 
here is actually a randomness expansion scheme, where 
a larger random string (the measurement outcome O) is 
generated from a smaller set of random seed which serves 
as the input X to specify the measurement configuration 
(AiAj). A figure of merit for the randomness expan- 
sion scheme is the net rate of random bits, defined as 
the number of bits generated minus the number of bits 
consumed. In the entanglement based experiment [3], 
it is still difficult to get a positive net rate of random 
bits with the current technology because of the slow en- 
tanglement generation rate. In our experiment, for the 
biased case, we have achieved a positive net rate for the 
first time with the output entropy exceeding the input 
entropy, leading to approximately 5246 net random bits. 
We have performed extensive random tests on the output 
strings in our experiment. The results are summarized 
in the supplementary information. 

We have proposed a scheme to generate genuine ran- 
dom numbers in qutrit systems where the randomness is 
guaranteed by violation of the KCBS inequality, a version 
of the Kocher-Specker theorem resulting from quantum 
contextuality. This scheme guarantees randomness with- 
out the need of using costly quantum resource such as en- 
tanglement, and allows for easier implementation and sig- 
nificantly higher generation rate of random strings. We 
have demonstrated this scheme with a proof-of-concept 
experiment using photonic qutrits and achieved for the 
first time a positive net rate of ture random numbers. 
The scheme can be readily implemented with other ex- 
perimental systems, such as single trapped ions, to close 
the detection loophole, opening up practical prospect to 
generate ture random numbers with high speeds. 
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the Kochen-Specker theorem in another different way to 
generate randomness. 



SUPPLEMENTARY INFORMATION: 
EXPLORING QUANTUM CONTEXTUALITY TO 
GENERATE TRUE RANDOM NUMBERS 

In this supporting information, we give a detailed 
derivation of the link between generation of random- 
ness and violation of the Klyachko-Can-Binicioglu- 
Shumovsky (KCBS) inequality. For completeness, we 
also briefly explain the specific KCBS inequality used 
in our experiment. On the experimental side, we give 
detailed configurations of the wave plates in our experi- 
ment and present results for several random tests on the 
output data string from the experimental measurements. 



I. The KCBS inequality 

The KCBS inequality was first introduced in Ref. [19]. 
It corresponds to a state-dependent proof of the Kochen- 
Specker theorem for a qutrit system. For complete- 
ness, here we give a brief derivation. Consider five two- 
outcome observables Aj (i = 1, 2, 3, 4, 5) and denote their 
outcomes as a«, whose values are assigned to be —1 or +1 
(one can also denote the two outcomes as and 1 as in 
the main text). For any such assignments, the following 
algebraic inequality holds: 

— aia2 — 0.20.3 — 030,4 — 0405 — 0501 < 3. (5) 

To arrive at the above inequality, we note that the prod- 
uct of the five monomials on the left-hand side is — 1. 
Consequently, at least one term is equal to —1, and the 
sum of the remaining four terms should not exceed 4. 
We thus get the above inequality. According to the non- 
contextual hidden variable model (NCHVM) , if the out- 
comes a,i are described by an unknown probability dis- 
tribution, we can integrate over the distribution to take 
average and the expectation values of the corresponding 
observables Aj then satisfy 

-(A 1 A 2 )-(A 2 A 3 )-(A 3 A 4 )-(A 4 A 5 )-(A 5 A 1 ) < 3, (6) 

Note that (A-.Aj) = P(cn = aj\A i A j )-P{a i ^ a^AiAj), 
so the above inequality (6) can also be written into the 



following form as shown in the main text: 
L= [P(o 4 djlAiAj) - P(o, = a^AiAj)] < 3. 

(7) 

Any NCHVM should obey the inequality (7). However, 
quantum mechanics violates this inequality for certain 
measurements on a specific state. In our experiment, 
we choose the state to be |$o) = |0). The five ob- 
servables are chosen as Aj = 2\ijj i )('4> i \ — I = 2(ctj|0) + 
All) + 7<|2»(oi<0| + + 7i<2|) - I, where I is the 
3x3 identity matrix and ct\ = 012 — «3 = «4 = 0^5 = 

y^sTs, A = -^cos- 1 ^, A = fa = -a^tan^, 
A = A = -A cos f , 71 = 0, 72 = -75 = A sin f , and 
74 = —73 = — v / 2/2. One can check that all the pairs 
(Ai,Aj) with € S are compatible (i.e., Aj and Aj 

commute). It is straightforward to show that for these 
specific measurements Ai under the state |$o)j quantum 
mechanics predicts that L = 4\/5 — 5 « 3.944 > 3, 
thus violates the KCBS inequality (7) imposed by any 
NCHVM. 

II. Generation of randomness via violation of the 
KCBS inequality 

To establish a link between quantum contextuality and 
randomness, we use notations and arguments similar to 
Ref. [3, 32] for the Bell's inequality case [13]. We say 
that the observables O — {0°£ } (i — 1,2,3,4,5) and 
the state p give a quantum realization of the joint prob- 
ability PajajlAiAj = {-P^iO, | A; A,)} if Pfaa^AiAj) = 

Tr^pO^ O^ .)- Here, O^. is a projector that projects the 
state onto an eigenstate of the observable Aj with eigen- 
value ai. For simplicity, we denote the quantum real- 
ization and the joint probability distribution as a triplet 
{p, O, P}. For one trial of experiment, the randomness of 
the output pairs conditioned on the input pairs (Aj, Aj) 
is defined as the min-entropy: 

^(ajajlAjAj) = -log 2 [maxP(a,jaj|AjAj)] (8) 

For any quantum realization of the joint probability 
P aia .|A ; A an d a given KCBS violation L, we aim to find 
a lower bound on the min-entropy: 

^(ajajlA^Aj) > f{L). (9) 

This is equivalent to solution of the following optimiza- 
tion problem: 

max P(ojaj|AjAj) 

subject to [P(fli 7^ a j|AjAj) — P(a,j = a,j|AjAj)] = L 

(i,j)es 

P{a l a \A l A J )=Tr{pO%O%) (10) 
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where the optimization is carried over all quantum re- 
alizations {p, 0,P}. Denote by P*( a i a i \AiAj) the so- 
lution to the above problem, then the minimal value of 
E 00 (aL i a.j\A. i A.j) consistent with the quantum theory and 
the KCBS violation L is given by E^SiiSL^AiAj) — 
— log 2 P* (aiOj ;| AiAj). To get a bound independent of 
the input pair (Ai,Aj), we should further minimize 
E oa (a. i a.j\AiAj) over all the input pairs (Ai,Aj). This 
leads to a lower bound f(L) on the min-entropy deter- 
mined by the KCBS violation L only. 

The above optimization problem can be efficiently 
solved by casting it to a semi-definite programing (SDP) 
problem. In Refs. [36, 37], an infinite hierarchy of con- 
ditions satisfied by all quantum correlations are intro- 
duced, and the hierarchy is complete in the asymptotic 
limit, i.e., if all the conditions in the hierarchy are satis- 
fied, there always exists a quantum realization {p, O, P}. 
All the conditions in the hierarchy can be transformed 
to a SDP problem. In general, conditions higher in the 
hierarchy are more constraining and thus give a tighter 
lower bound f(L) to £' 00 (aia : , |AiA J ). We use the mat- 
lab toolboxes SeDuMi [38] to solve the SDP problem for 
the optimization. The result is plotted in Fig. 1 of the 
main text. From the figure, f(L) equals zero at the clas- 
sical boundary L = 3 and increases monotonously as the 
KCBS violation L increases. For the maximal violation 
L = AVE - 5, P* = 0.457, corresponding to /(£) ~ 1. 13 
bits. 

We can obtain an upper bound on the min-entropy by 
numerically searching for solutions to Eq. (10) under a 
fixed dimension of the Hilbert space. When the Hilbert 
space dimension is fixed to be 3, we find that the upper 
bound coincides with the lower bound up to a precision 
of 10~ 5 . This indicates that the lower bound obtained 
above is tight. 

The above bound depends on the quantum violation L 
of the KCBS inequality, which itself needs to be deter- 
mined from a finite runs of experiments. Now we derive 
a practical bound on the min-entropy that can be deter- 
mined from a finite runs of experiments, taking into ac- 
count the statistical error on estimation of the quantum 
violation L and the classical side information a possible 
adversary may have on the device. To this end, let's first 
introduce the following theorem: 

Theorem 1. Suppose we run the experiments k times 
and the sequence of inputs X = (A^ , Aj t ; • • • ; Ai k , Aj k ) 
is generated by choosing each pair of inputs (A in , Aj n ) 
independently with probability P(AiAj). Let S, e' > 
be two arbitrary parameters and r = miiiij{P(AiAj)}, 
then the distribution P(OX£) characterizing k successive 
use of the devices is e'-close to a distribution T> such that, 
either T>(m) < 5 or 



E^iO^E.m)^ > kf(C m - e) + log 2 S, 



where e = (L q + l/r)-v/— 2 In e'/fc with L q 
denoting the maximal KCBS violation. 



(11) 

/5 - 5 



Proof. We follow similar procedures and arguments in 
Ref. [32] to prove the above theorem. Define a function 
T{L) = 2~f^ L \ then from the solutions to the optimiza- 
tion problem Eq. 10 and Fig. 2 in the main text, it is easy 
to obtain that J 7 is a concave and monotocially decreasing 
function. Denote by O n — (a^ , a^; • • • ; a.i n , a,j n ) (n < k) 
the string of outputs before the (n + l)th round of ex- 
periment (similarly, X n denotes the string of inputs) . We 
define an indicator function x(e) as: x( e ) = 1 if the event 
e happens and x( e ) = otherwise. Consider the follow- 
ing random variable 



, \ xK = M; aj, = v} Aii = A ii = V) M ,^ 
pfcfi £2) 



(Aw);(x,i/)eS 

where S is defined in the main text and t(p, v) (/i, v — 
0, 1) is a sign function defined as: t([x, v) = —I if p = v 
and r(p, v) = 1 otherwise. It is straightforward to see 
that Eq. (12) corresponds to the KCBS expression (2) 
in the main text and the expectation value of Li condi- 
tional on W l is equal to L(W l ), i.e., E(L\W l ) = L{W l ). 
Here W l = (O l ~ 1 X l ~ 1 £) denotes all the events before 
the Zth round of experiment and the possible adversary's 
classical side information. Let L = \ X^=i Li be our es- 
timator of the KCBS violation. After specify the above 
notations, now let's also introduce two lemmas for the 
proof of the theorem: 

Lemma 1. For a given parameter e' > 0, let e = (L q + 

lAV-21ne7fcaiidT 6 = {(0,X,£ )|± £?=i E(£,|W) > 
L(0,X) — e}, then we have: 
(i)for any (0,X,S) eT e , 

P((D\X£) <F k (L(0,X)-e). (13) 

(ii) 

Pr(T e )= V P(0,X,S)>l-e'. (14) 



E 

\Z,£)eT £ 



Proof. By using the Bayes's rule and the fact that the 
response of the system does not depend on the future 
inputs and outputs, we have: 



P(0\X£) = jjpCoi.aj.lO'-^f) 

k 



h^k^ia^w') (is) 



z=i 

From Eq. 10, the probability P(a il aj l \Ai l A n W l ) is 
bounded by a function of the KCBS violation L(W l ): 
P^a^AitA^W 1 ) < T(L{W 1 )). Thus, we have: 

k 

P{0\X£) < *[[F(L(W 1 )) 

i=i 



< F k {L(0,X)-e), 



(16) 
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where the equality E(L\W l ) = L(W l ) and the fact that 
J- is logarithmically concave are used in the second in- 
equality. For the third inequality, we used the definition 
of T e and the fact that T is monotonically decreasing. 

To prove Eq.(14), let's define another random variable 
M q = £*=i(£i - E(L\W 1 )). The sequence {M q : q > 1} 
is a martingale process [39]. The range of the martin- 
gale increment is bounded by \Li — L(W')| < - + L q . 
From the Azuma-Hoeffding inequality P(M q > ke) < 

eX P(- 2 fc(l ( /r+L,)^ ) I 39 " 41 ]' We have 

p{\imL\W l )<\j^U-^ <e', (17) 

V 1=1 1=1 / 

where the equation e = (L q + l/r)y/— 21ne'/fc is used. 
Eq. (17) combined with the definition of T e gives the 
Eq. (14) desired. 

The above discussion considered the case that the ran- 
dom variable sequence O only takes values in the output 
space S fe = {— 1, 1} . Similar as in Ref. [32], we extend 
the range of O and view it as an element of S fe U _L with 
P(<D\I£ ) = if O = JL. In fact, _L can be regarded as an 
"abort-output" produced by the devices, from which no 
KCBS violation has be obtained. 

Lemma 2. There exists a probability distribution 
V = {£>(£>, Z,£)} that is e'-close to P = {P(0, !,£)}, 
i.e., d(V,P) = ±J2 W \P(0,T,£) -V(<D,1,£)\ < e'. 
Distribution V also satisfy the condition: 

V{0\1,£) <F k {L{0,I)-e), (18) 

for all (0,1,£) such that O ^ _L. 

Proof. We only have to construct a probability dis- 
tribution satisfy all the conditions. Let T>(0,I,£) = 
P(1)P(£)V(0\1,£), with V{0\T,£) defined as: (i) 
V(0\X,£) = P(0\1,£) if (0,1,£) e T e \ (ii) V{0\2,£) = 

if O ^ 1 and (0,1,£) <£ T £ ; (ui) V(±\X,£) = 

1 — J2(o i £)■ Then it is straightforward 
to obtain from Lemma 1 that V satisfies Eq. (18) for all 
{0,1,£) such that O^l, and 

d(V,P) 

= \J2 \P(0,1,£)-V(0,1,£)\ 

0, x,s 

1, e a 

= l -[ P(0,Z,£) + 1- E P(G,1,£)} 

< e'. 

After introducing the above two lemmas, now we are 
ready to prove Theorem 1. As in the main text, let 
{£ m ■ < to < m max } be a series of KCBS violation 
shresholds and V(m) the probability that the observed 



KCBS violation L lies in the interval [£ m , C m +i)- De- 
note Y m = {0\0 ^ _L and C m < L < C m+1 }. By using 
Lemma 2 and the fact that J- is monotically decreasing, 
we have: 

E^Oll, £,m)v 
= -log 2 ^2v(X,£\m)[maxV(D\l,£,m)] 

X,£ 

= -log, y^V{l,£\m)—-^—r max V{0\1,£) 
62 v . i >D{m\I,£) ocY m y 1 ' ' 

X,S v ' 

= fc/(£ m - e )-log 2 ^. 

Here in the last inequality, the equation / = — log 2 J~ 
is used. The above equation immediately leads to the 
claims in Theorem 1. 

Theorem 1 tells us that there is essentially no dif- 
ference between the distribution P, which characterize 
the outputs O of the devices and their correlations with 
the inputs I and the adversary's classical side informa- 
tion £, and the distribution T> defined above [32]. If 
we have confidence that the observed KCBS violation L 
lies in [£ m ,£ m+ i) with non-negligible probability, i.e., 
T>(m) > 5, then the entropy of the outputs O is guaran- 
teed to have a positive lower bound kf(C m — e) — log 2 y, 
that is, the randomness of the outputs is guaranteed to 
be larger than kf(C m ) up to epsilonic corrections. 

III. Generation of randomness under relaxed 
conditions 

It has been shown in Ref. [3] that violation of Bell's in- 
equality can be used to certify randomness even without 
the need of quantum mechanics. One only needs to as- 
sume the no-signalling (NS) condition: for two measure- 
ments corresponding to space-like events, one measure- 
ment has no influence on the marginal distribution of the 
outcomes of the other measurement. Here, for the single 
qutrit protocol, we can similarly assume a relaxed con- 
dition that corresponds to the NS condition for bipartite 
systems. For two compatible measurements, we can as- 
sume one measurement has no influence on the marginal 
distribution of the outcomes of the other measurement. 
Quantum mechanics obviously obey this rule. So, com- 
pared with the assumption of full formalism of quantum 
mechanics, this condition corresponds to a significantly 
relaxed requirement. To emphasize the correspondence, 
we still call this assumption the NS condition, although 
it is not directly connected with no signaling for single 



qutrit systems. Under only the NS condition, the opti- 
mization problem (10) should be replaced by 

max P(ai<ij\AiAj) 
subject to [P(a-i ^ cij\AiAj) — P(cii = a^l-AjA^)] 

< Pia.aAA.Aj) < 1, 
^2 P(a i a j \A i A j ) = 1, 

CLiCLj 

a j 

a,i 

where the last two equalities are mathematical descrip- 
tion of the NS condition. With a given quantum violation 
L of the KCBS inequality, we can analytically solve the 
above optimization problem using linear programming 
and obtain f(L) = -log 2 (1.75 - L/A). In Fig. 1 of the 
main text, we plot this analytic bound f(L) versus L un- 
der the NS condition. Its value becomes strictly positive 
as soon as L exceeds the classical bound 3. 

IV. Experimental configuration of the wave plates 

In this section, we give more details on the exper- 
imental configuration of the half wave plates. The 
experiment setup is show in Fig. 3 of the main text. 
As stated in section I, we choose the qutrit state to 
be $o = |0), which is prepared by setting the angles 
of HWPO, HWP1 and HWP2 to be 0, tt/4, and -tt/4, 
respectively. Using the linear optics transformation rules 
for the HWPs and the PBS, we find that for this setup 
a click in the detector Dl (D2) corresponds respectively 
to a projection to the state \tpi) (IV^)), with \ipt) — 
cos(20 2 ) | 0) -sin(26» 2 ) 008(20! ) | l)-sin(20 2 ) sin(20i ) 1 2) and 
\ip 2 ) = cos(2(9 3 ) sin(20 2 )|O) + [cos(26> 3 ) cos(20 2 ) cos(20i) - 
sin(20 3 )sin(20i)]|l) + [cos(20 3 ) cos(20 2 ) sin(20i) + 
sin(20 3 )cos(20 1 )]|2). Here, 9 1 , 9 2 and 3 denote the 
angles of HWP5, HWP6, and HWP8, respectively. 
Based on this transformation, we obtain the angles of 
the HWPs corresponding to the measurements Ai given 
in Sec. I of this supplementary information. These 
angles and the their corresponding observables are listed 
in Table. I. 

V. Statistical tests of the generated random numbers 

To check the quality of the random numbers generated 
in our experiment, we carry out a number of statistical 
random tests [42, 43]. The length of the output string 
in our experiment is about 10 5 , so we choose the ran- 
dom tests that are statistically relevant at this string size. 
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TABLE I: | Angles of the half-wave plates (HWP5, HWP6 
and HWP8 in Fig. 3 of the main text) to measure five pairs 
of compatible observables. 



To be specific, we perform the random tests called "Fre- 
quency", "Block Frequency", "Runs", " Longest-Run-of- 
Ones in a Block (LROB)", "Non-overlapping Template 
Matching (NOTM)", "Serial", "Approximate Entropy 
(AE)", "Cumulative Sums (Cusums)" [42], and "Two- 
bit" [43] . All these tests are implemented by Mathemat- 
ica programs. For the qutrit system, quantum theory 
predicts that the number of ones in our output strings 
should be larger than that of zeros in the output string. 
So, we first perform a Von Neumann extractor [44] to the 
rough data before the tests. 

The test results are summarized in Table II. What we 
show in the table is the so-called p-values, which are in- 
dicators of the test results. More precisely, a p-value is 
the probability that an idea random number generator 
would have produced a sequence less random than the 
sequence in test [3, 42]. In other words, a bigger p-value 
indicates that the sequence in test is more likely to be 
random. Therefore, a p-value of simply means that the 
tested sequence appears to be completely non-random, 
whereas a p-value of 1 implies that the sequence in test 
appears to be perfectly random. Usual p-values lies in 
the open interval (0,1) and a significance level i9 should 
be introduced for the test. If the p-value > we ac- 
cept the tested sequence as random. Otherwise, it is 
non-random. Typically, is chosen to be in the range 
[0.0001,0.01]. Here, we choose $ = 0.001. A sequence 
with a p-value larger than 0.001 passes the test and is 
considered to be a random sequence, otherwise it fails 
the test. 

From the Table, all the four sequences generated by the 
detector Dl and D2 separately pass all the tests. This 
confirms the validity of the experiment. For both the uni- 
form and the biased input cases, the joint output strings 
produced by the detectors Dl and D2 arranged in the 
order (a^ , aj x ; • • • ; aj fc , a,j h ) cannot pass the test. This is 
expected since the measurement outputs of the Dl and 
D2 detectors are correlated due to quantum contextu- 
ality. We should note that the random tests just con- 
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1 

Statistical lest 


Uniform inputs 


Biased inputs 


Si 


S 2 


s, 


Si 


S 2 


s, 


Frequency 


0.1619 


0.0663 





0.8694 


0.9103 





Block Frequency 


0.0062 


0.2809 





0.0771 


0.1155 





Runs 


0.4864 


0.7162 


0.1085 


0.3426 


0.4157 


0.7855 


LROB 


0.0487 


0.0163 


0.0002 


0.0166 


0.4008 


0.0239 


NOTM 


0.5471 


0.6533 





0.2603 


0.0057 





Serial 


0.0462 


0.468S 





0.7215 


0.0119 





AE 


0.0432 


0.4699 





0.7236 


0.0120 





Cusums 


0.1603 


0.0553 


0.9999 


0.4205 


0.4251 





Two-bit 


0.2976 


0.1720 





0.6290 


0.7061 






TABLE II: | Results of the random tests described by the p- 
values of the output strings. Si and S2 denote the sequences 
separately generated by detector Dl and D2, respectively. S t 
is the output string of Dl and Dl together, arranged in the 
order (aj , a J0 ; ■ • ■ ; a,i k , aj k ) , which has finite correlation due 
to quantum contextuality and cannot pass any of the random 
tests that are sensitive to correlation. 

firm our expectation. No random tests on finite strings 
should be considered complete. Much stronger evidence 
of randomness in the output string of our experiment is 
provided by the observed KCBS violation, which is in- 
dependent of any hypothesis on how the experiment was 
carried out. Violation of the KCBS inequality guarantees 
that the entropy of output string has a positive lower 
bound. In this case, one can always use a randomness 
extractor [44, 45] to convert the string into a new one of 
size kf(C m — e), which is almost uniformly distributed 
and perfectly random. 
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